22 ms·

DOJ: Strong encryption that we don’t have access to is “unreasonable”

306 points by nimbius 9y ago

deleted 9y ago
[deleted]
hprotagonist 9y ago
encryption that the DOJ has access to, isn't.
rubyfan 9y ago
What did the police do before there was the internet or phones?
- olliej 9y ago
  Right? Apparently police never solved crime before they were allowed full access to every aspect of your life.
  - kobeya 9y ago
    To be fair, it used to be that they didn't really solve most crimes.
    - olliej 9y ago
      there has never been a point where they solved most crimes. The difference is now people just happen to be carrying more information with them in their pocket than they ever had before.
    - mattrices 9y ago
      To be fair, they still don't
- thephyber 9y ago
  They do just like they do now: lobby to get more laws to either (1) gain more leverage to coerce compliance or (2) criminalize actions which are tangent to the behavior they want to coerce. I realize your question was rhetorical.
- AzMoo_ 9y ago
  I'm no supporter of insecure cryptography, but before there was internet or phones and access to such, lots of crimes went unsolved.
  - wahern 9y ago
    Clearance rates for homicide have _dropped_ over the past 50 years: America’s homicide clearance rate—the percentage of solved crimes that lead to arrest—has fallen considerably in the past 50 years, from around 90% in 1965 to around 64% in 2012, according to federal statistics. (https://www.economist.com/news/united-states/21656725-police-fail-make-arrest-more-third-nations-killings-getting-away https://www.economist.com/news/united-states/21656725-police...) (See, also, https://www.citylab.com/equity/2017/06/police-arent-getting-better-at-solving-murders/531642/ https://www.citylab.com/equity/2017/06/police-arent-getting-...) IMO, similar to counter-terrorism efforts (most spectacularly, 9/11), technology becomes a crutch. Frankly, I wouldn't be surprised if mass encryption leads to _improved_ clearance rates, as law enforcement becomes less complacent. Take this latest example: the FBI agent declines Apple's help because he's convinced the geeks at the FBI lab can handle it. He presumably doesn't bother actually confirming with the geeks in the lab, nor does he attempt to put Apple in touch with the lab. Just utter complacency, confident that the machine (computers, bureaucracy) will suffice. This sort of laziness wouldn't have been tolerated in Hoover's FBI. Moreover, Hoover likely would have been more aggressive using the tools available to him--keyloggers, etc--rather than whining.
    - saulrh 9y ago
      Wouldn't that be a change in data collection more than in absolute quality of problem-solving? Japan, for example, I remember reading that their near-perfect homicide rate is actually because they'll classify it as "fell down some stairs" if they can't solve it. Particularly in the US with its history of social issues, I can easily see a ton of homicides in the 50s just never being written down.
      - bradknowles 9y ago
        Or homicides that were attributed to some person that it was convenient to lock away and who were unable to prove their innocence.
- gooseus 9y ago
  I imagine they spent a lot of time solving crimes, asking questions like: "Where did they keep all their papers and correspondence?" "Can somebody come break into this safe we have a warrant for?" What did the cops do before X was invented? They didn't worry about X being used to commit or cover up criminal activities while continuing to try to do their job of keeping communities either safe or oppressed, depending on how well they related to them. I support strong crypto, but I think implying detectives and the DoJ are just too lazy or dumb or whatever to deal with this problem is a little unfair. Apologies if that wasn't the implication
  - yorwba 9y ago
    Except in most circumstances, there wouldn't have been any papers, because nobody was recording all their conversations. Nowadays, everything is happening digitally and is stored indefinitely by default; and law enforcement feels like they deserve access to all that. The attempts at preventing ubiquitous encryption don't seem to be focused on crimes where there would have been a paper trail if people still used paper; they are focusing on reconstructing the last year or so of someone who is either dead or uncooperative, all in hopes of finding something they can use. If they were targeting organizations with a bureaucracy for some crime, I think they could just demand access to all documents and get them? If I remember correctly, in the Levandowski case Google's lawyers got access to a huge trove of Uber's internal emails. If a private company can get that access, it should be possible for law enforcement as well, no?
  - deleted 9y ago
    [deleted]
- belorn 9y ago
  In my nation, and as I hear in many other places, the police force was much more decentralized in the past. You had local police handling problems at the local level using local knowledge. As I hear/read it was a bit more costly, had the occasional problem of local corruption, quality had a bit more variance, organized crime was a bigger problem, but the average crime had better results and was done quicker. There was also no mass surveillance.
  - dx034 9y ago
    That's also because criminals needed local knowledge. If I wanted to commit a crime today in another city, I can get there easily and quickly and get all the info I need online. In the past, small cities would've noticed strangers but (luckily) you can walk through other cities nowadays without people objecting that. For the police that means that they need to follow criminals and be able to share information nationally and internationally.
- bonestamp2 9y ago
  They would open letters, tap phones and watch bank accounts. All of those things can be subverted now. That said, they were just lucky back then... it doesn't mean everyone should suddenly give up their right to privacy now.
olliej 9y ago
I wish this could be hammered into the thick heads of congress: there is secure, and there is insecure. There is not a gradient.
- SomeStupidPoint 9y ago
  That's... just not true. And that kind of misrepresentation just weakens the arguments for strong encryption, because intelligent people will see them as pretty transparent misrepresentations. Have you considered that's why the arguments for strong encryption aren't going well -- that we're not actually engaging with intelligent people trying to understand the issue, we're chanting trite, shallow inaccuracies? I mean -- "there is not a gradient"? ...what do you call changing key size? Ed: I'd like the people downvoting to explain how changing the keysize isn't a gradient of security. (Hint: You can't, because it is.)
  - olliej 9y ago
    We change key size because what is secure in terms of key size is literally compute bound. Key strength changes because we predict when a key will /cease being secure/. That said most of the demands made by DoJ aren't for reduced key size, they're for variations of key /escrow/: literally breaking the security model of crypto entirely. So maybe I could be more specific: there is no such thing as an almost secure protocol. The key (ha!) result of this recognition is that all secure protocols have been moving to some variant of ephemeral keys. Specifically to deal with the problem of all static keys eventually becoming insecure.
    - SomeStupidPoint 9y ago
      > Key strength changes because we predict when a key will /cease being secure/. Yes, we use keys up the gradient of security that key size represents as attacks become more powerful. The reason we don't use the more secure keys in the first place isn't that 2048b keys weren't always more secure than 1024b keys -- it's just that we didn't (for most purposes) need to be that secure, and so we choose an appropriate spot on the gradient for our cost-benefit analysis. Pretending that's not a gradient of security is simply dishonest. > That said most of the demands made by DoJ aren't for reduced key size, they're for variations of key /escrow/: literally breaking the security model of crypto entirely. That's missing the plot for the details: the DoJ wants a method by which they can break into digital safes in a manner similar to physical safes. Their proposal is key escrow, but that's partly because technologists didn't suggest a better way when the DoJ simply asked to get it done with little guidance. So they made a specific ask. And it sucks -- because they're not technologists. Everyone knows it, but the DoJ isn't inclined to let people flat out refuse. Pretending that there aren't technical solutions with transparent ruses -- like there aren't gradients of security -- are how we got to lawyers demanding technical features. I don't disagree with you that we should use secure protocols, I'm just saying we need to hold ourselves accountable for honest and strong arguments, not ruses. The one you end on -- that using ephemeral keys is fundamentally a stronger algorithm that doesn't work well with long term taps -- is a strong argument. Much better than things like "there aren't security gradients" -- partly because they're actually true.
tzs 9y ago
If they want to convince me to accept some kind of back door in my encryption, they have to propose a system where it can be shown that it cannot be abused by bad actors within my government, and where there are clearly stated public rules about when it can be used. It is possible to design such a system, where the probability of abuse is arbitrarily low [1], but I have a hard time imagining the current DOJ proposing such a thing. [1] key escrow with access controlled by a multilevel secret sharing system that requires consensus among a diverse international group of shareholders to release the key from escrow. The shareholder group is chosen so that it includes a mix of public and private entities in a variety of jurisdictions, including anonymous shareholders, so that no entity can acquire enough power or influence to force a key to be revealed.
- kobeya 9y ago
  > key escrow with access controlled by a multilevel secret sharing system that requires consensus among a diverse international group of shareholders to release the key from escrow. The shareholder group is chosen so that it includes a mix of public and private entities in a variety of jurisdictions, including anonymous shareholders, so that no entity can acquire enough power or influence to force a key to be revealed. Intelligence agencies will just steal the keys, and then individual actors leak them onto the black market.
  - tzs 9y ago
    The probability of that can be made arbitrarily low by proper choice of parameters for the secret sharing system, at least against realistic threats over realistic timeframes.
    - heylook 9y ago
      What are some examples of such parameters?
      - justinjlynn 9y ago
        That's a good question. We should probably be cooperating to find out instead of asking it to silence ideological opponents. It might be useful to know for transient key secure multiparty computation.
CyberDildonics 9y ago
I think people not having access to the details of their government is unreasonable.
c3534l 9y ago
The government has demonstrated that they will abuse every power given to them, and even those that weren't. I would not entrust every aspect of my personal information to the very same organizations that indefinitely detains people, including American citizens, without access to a lawyer while commiting acts of torture; and the ones that said the Patriot Act could never be used for domestic surveilance; that lied about being unable to unlock the phone of the last guy they tried this with to get the law changed; and that continues to engage in parallel construction, torture by proxy, and extraordinary rendition. And now they're saying that we should trust them to stop those bad guys once again. And the most chilling aspect of this request, despite its inherent absurdity, unenforcibility, and threat to freedom and privacy, is that they have a very good chance of winning that power.
- alsetmusic 9y ago
  > that lied about being unable to unlock the phone of the last guy they tried this with to get the law changed… I found it very telling that they announced their inability to access the phone only a few days after the incident. It struck me as a very clear PR move that was designed to lay the groundwork to shape public opinion. My threshold for declaring that the device is inaccessible requires more time for research and effort than this.
  - c3534l 9y ago
    Don't forget that the phone was unencrypted when they got it, and that it was the FBI who locked it in the first place: https://www.nytimes.com/2016/03/02/technology/apple-and-fbi-face-off-before-house-judiciary-committee.html https://www.nytimes.com/2016/03/02/technology/apple-and-fbi-...
    - alsetmusic 9y ago
      I have no idea how I never knew that. I thought I followed the case fairly well, but had never read about user error on the part of the FBI. For all the articles written, this was a very under reported detail.
- 9y ago
deleted 9y ago
[deleted]
PenguinCoder 9y ago
The wording of this brings up a worrisome point. What encryption methods does the DOJ currently have access to? Why are they complaining about needing access to this encryption now? Is it because other previous encryption methods are know to be broken or they already have access to that data?
- MichaelGG 9y ago
  Probably because so many communications are moving to encrypted by default, HTTPS everywhere and WhatsApp for instance (as Brazil has found out). If the big players decide to switch to E2E then governments would need to get them to change their products. Better to head them off before it is too late.
  - 0xfeba 9y ago
    This is exactly it. The Going Dark Problem: https://www.fbi.gov/services/operational-technology/going-dark https://www.fbi.gov/services/operational-technology/going-da...
api 9y ago
This has been the refrain for 35 years. Open source strong encryption is everywhere now. The horse has left the barn, farm, county, state, and is currently swimming the Pacific. Police have other ways to fight crime. Eventually we may be forced to deploy the ultimate weapon, namely correcting the social, economic, psychological, and neurological factors that breed it in the first place.
bo1024 9y ago
It's hard to know where to even begin in arguing against this. There's the freedom/privacy argument, but I guess this is debatable depending on if you view computer files as an extension of your ideas/knowledge, or an extension of your physical possessions. Someone brought up the entire "risk of overreach and abuse" argument. There's also the likelihood of any tools the government has being leaked and used by bad actors (as we have seen too much recently). Oh, and the "it's technologically impossible" argument, which should be the only one you need -- but they refuse to hear that. (Are there some supposed experts who are telling the DOJ this can be done?)
- 1001101 9y ago
  > Someone brought up the entire "risk of overreach and abuse" argument. I don't have a problem with the authorities operating within the purview of the Constitution, eg. a warrant from a court for a particular device. That, however, is not how we got to where we are today.
- hackinthebochs 9y ago
  >Oh, and the "it's technologically impossible" argumentbe the only one you need -- but they refuse to hear that. Things like DUAL_EC_DRBG seem to prove this claim false.
  - bo1024 9y ago
    I guess if you set the bar for what you want to accomplish at barely above "nobody is allowed to encrypt anything, ever." Nobody would knowingly use such a scheme. It's also a security hole giving access to anyone with the key, which is sure to be leaked/compromised if shared with the entire DOJ and others. Also, once the key is compromised, everything in the past that was ever encrypted is now readable by anyone.
    - hackinthebochs 9y ago
      >Nobody would knowingly use such a scheme. Actually, most people would use it because most people just don't care that much. >which is sure to be leaked/compromised if shared with the entire DOJ and others But this is a policy issue, not an issue with the idea of backdoored encryption. There are policies that could reduce the probability of leak to negligible levels (e.g. a secure NSA facility does all the decryption). Not to mention that only the NSA will be in a position to decrypt your communications from 5 years ago. No one else is storing such a vast quantity of data.
gxs 9y ago
When I was in college, there was a retired guy that would come in to tutor students as a way to stay busy. He was your stereotypical brainiac type dude - quiet, lanky, glasses, soft spoken, and razor sharp. He must have been in his 50s, but you would think he had just completed upper division math, chemistry, and physics "last semester" with perfect grades to boot. He told me a story about how once while in his Masters program, one of his colleagues figured out how to do some cool stuff with unenriched uranium. Almost like out of a movie, he said, the government stepped in and made sure he did not publish his research. I wonder if we'll see that type of stuff happen with cryptography or if it's already happening. I wouldn't be surprised if these theatrics were just to maintain the illusion that they don't have access to stuff.
- AstralStorm 9y ago
  And then Chinese figure it out for a third of the price and have a monopoly on nuclear reactors. Remember the time when organisations like DARPA actually promoted public research of this magnitude? Or when DoD was making certain research public?
brian-armstrong 9y ago
Here's my biggest complaint with this debate - people are confusing literal with metaphorical. They make the analogy of the unbreakable safe. Encryption isn't that. You can still recover the physical phone and all of the storage chips on it. That the patterns of bits in the chips make up some unrecognizable utterance is seemingly immaterial. I could write gibberish in my journal at home if I wanted to, and I think we'd all agree it would be ridiculous for the FBI to run around screaming about unbreakable ink
- tryingagainbro 9y ago
  His comment makes sense to 99% on non-tech people, and if it was possible it would make sense to all. Would we want to open Bin Laden's iPhone? He wants you to have your home with 100 locks, guard dogs and armed guards. BUT if a court orders you, you have to let the police in to check x, y and z. Now I don't think that a secret key can be somewhere and stay safe for a long time. It will be leaked or hacked. This places hundreds of million innocent people at extreme danger of having everything personal revealed. So, IMO, giving the cops a master key opening all our doors "if needed" doesn't work. TSA does that, but presumably while cameras are running, and this is stuff we know it will be searched. So encryption is the best option.
  - brian-armstrong 9y ago
    But again you've made the same error. The locks can be opened and the phone retrieved. iPhones are not indestructible, you can access any part of them if you want.
    - tryingagainbro 9y ago
      And do what with an encrypted one? They want the contents, not the phone. Frankly, they might even return it after making a copy of it /fingerprints etc.. Spend $1m on a zero day for each case? What if they run out of zero-days?
      - JoshTriplett 9y ago
oceanghost 9y ago
These complaints have always felt like disinformation to me. I assume they have larger capabilities than they let on, its just they can't prosecute without revealing that.
rayiner 9y ago
I can’t overstate how important it is for Google, Apple, and Microsoft to keep hammering at this. It’s workkng. The DOJ is running into this a lot now (e.g. can’t get into a drug dealer’s iPhone to see who he’s messaging). Eventually, they’ll see that the ship has sailed and encryption is just something they have to deal with.
- cvwright 9y ago
  That's an incredibly optimistic take on this problem. Google, Microsoft, EFF, et al need to win every single battle or they lose the whole war. The DOJ just needs to find one sympathetic test case, or one sufficiently horrible incident to get the laws changed. Like the Patriot Act in the US, or the new French surveillance law that passed after the Bataclan attacks. It's the classic asymmetry problem that makes security so hard in general. Only now, the party with all the money and power and time is also the one who only needs to win once.
arca_vorago 9y ago
This subject always reminds me of a talk I heard Eben Moglen give, where he said: "In 1995, there was a debate at Harvard Law School – four of us discussing the future of public key encryption and its control. I was on the side, I suppose, of freedom. It’s where I try to be. With me at that debate was a man called Daniel Weitzner who now works in the White House making Internet policy for the Obama administration. On the other side was the then Deputy Attorney General of the United States and a lawyer in private practice named Stewart Baker who had been chief council to the National Security Agency, our listeners, and who was then in private life helping businesses to deal with the listeners. He then became, later on, the deputy for policy planning in the Department of Homeland Security in the United States and has much to do with what happened in our network after 2001. At any rate, the four of us spent two pleasant hours debating the right to encrypt and at the end there was a little dinner party at the Harvard faculty club, and at the end, after all the food had been taken away and just the port and the walnuts were left on the table, Stuart said, “All right, among us now that we are all in private, just us girls, I’ll let our hair down.” He didn’t have much hair even then, but he let it down. “We are not going to prosecute your client, Mr. Zimmermann," he said. “Public key encryption will become available. We fought a long, losing battle against it, but it was just a delaying tactic.” And then he looked around the room and he said, ”But nobody cares about anonymity, do they?" And a cold chill went up my spine and I thought, all right, Stuart, and now I know you’re going to spend the next twenty years trying to eliminate anonymity in human society and I am going to try to stop you and we’ll see how it goes. And it’s going badly." https://www.softwarefreedom.org/events/2012/Moglen-rePublica-Berlin/transcript.html https://www.softwarefreedom.org/events/2012/Moglen-rePublica...
- phkahler 9y ago
  It's odd because peoples desire for anonymity is preventing their use of good encryption. A solid online identity and reliable way to get data to you without 3rd parties would be a good foundation for exchanging keys and encrypting data between parties. I'm talking fixed IP addresses as a starting point. We have whole infrastructure to make it easy to interact with public web sites (DNS, etc) but it's very hard to find and send a packet to your friend. Any efforts to change this would be seen by a lot of people as an attack on anonymity. I don't want make believe anonymity, I want to know where data is going and where it's coming from. Once I have that I can encrypt for privacy and web sites can strip identifying information if they want to provide an anonymous forum.
rrhd 9y ago
> "And I think that's a legitimate issue that we can debate—how much risk are we willing to take in return for the reward?" he said. None. Stop talking you ignorant fool.
hguhghuff 9y ago
Is this crazy or not? And if it's crazy, what's the best way to argue against it?
unabst 9y ago
The argument here is extremely simple. Encryption is the only way to secure information. This is true for criminals and non-criminals alike. To deny encryption is to deny security to everyone. Presuming it's the criminals who will look to exploit these vulnerabilities, denying security is making every non-criminal susceptible to attack. So the only question that needs to be answered is this. Do we want to protect our citizens? The only answer is yes. The only solution is encryption. The problem with strong encryption is that it already exists. Even if strong encryption were made illegal, criminals will be the one's securing their data despite the law. To deny citizens the right to protect themselves is just putting them all at risk. It's disarmament. Under the law, all the police should need is a warrant. It's not even an exception to any rule.
- bradknowles 9y ago
  But how do you design a strong encryption algorithm that can be trivially unlocked once a warrant is provided? Answer: you can’t.
  - unabst 9y ago
    That's not the point. Like a body buried in the desert, there is nothing that can force a person to reveal anything. Silence is encryption enough when it comes to secrets. Torture doesn't work either. So it's business as usual. It's obstruction of justice. Book'em. And of course, "I can't remember" is always the greatest defense. This whole thing is about the government endangering the public in exchange for abusing their rights. It's all bad. You could go as far as argue that the government is obstructing justice and endangering the public by denying basic security. We already know the enemy will find ways to access all the data. Encryption is not the last line of defense. It's the only line.
    - AstralStorm 9y ago
      Can't remember is a statement that can be disproven. Pleading non self incrimination laws (as per Miranda) is more effective. Even if you have nothing incriminating. This is what DoJ wants to close by making just possession of encrypted documents criminal. (Note: not a lawyer.)
nickwanninger 9y ago
Gotta love the fact that the EU seems to think the exact opposite https://www.theguardian.com/technology/2017/jun/19/eu-outlaw-backdoors-new-data-privacy-proposals-uk-government-encrypted-communications-whatsapp https://www.theguardian.com/technology/2017/jun/19/eu-outlaw...
- Freak_NL 9y ago
  It's not as simple as that. In the EU there are lots of political factors (like the director of the Dutch intelligence service, to name just one) that are quite vocal about abolishing strong end-to-end encryption; just as there are political factors in the US that wish to grant citizens the freedom to use strong encryption unencumbered.
  - dx034 9y ago
    But apart from the UK, Intelligence services in European countries tend to have less influence and aren't as popular with the general public. Many people have bad experience with intelligence services (Germany in the 30s/40s, Eastern European countries until 1990) so that there's still a lot of mistrust. That has changed a bit with recent terror attacks (fear of terror outweighs other fears) but in general, data protection is taken much more seriously in Europe than in other regions and that doesn't only include companies but also the state.
  - sametmax 9y ago
    Which is funny when you think they invented enigma in the first place.
    - Freak_NL 9y ago
      The Enigma machine was invented by the Germans, not the Dutch.
      - sametmax 9y ago
        Sorry, deutschemark being the german money before the euro, I still confuse them in my head.
hinkley 9y ago
The reasonable man adapts himself to the world: the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man. - George Bernard Shaw
jarym 9y ago
Governments are the next on the Silicon Valley ‘disrupt’ list. The music industry had to be dragged kicking and screaming away from their physical distribution model. Governments will have to be dragged similarly until they accept encrypted content is something they have the same right of access to as private thoughts.
Dowwie 9y ago
The moment that the US government stops complaining about encryption is when you will know that it has found a way through it.
- dx034 9y ago
  That would be too transparent. Also, if they really crack popular encryption, only few people will know to avoid any leaks. Maybe they'd complain even more to give people the feeling that they cannot crack that particular method.
DanielBMarkham 9y ago
"law enforcement equities" What an odd phrase. We have a criminal justice system in this country that is adversarial and is tilted in favor of the accused. That's because our founders realized the immense power of the state could easily overrun any person it wanted to unless there were strict and tight guards on what they could do. These lawyers, who presumably should know much more about all of this than I do, continue to make cases that strike me as "There are bad people! Because they are really bad, we need to change the game to give us more power" But there have always been bad people. There always will be. There is no stopping that fact. It is part of being human. I wonder if these people realize that even if they continue to get their way, the only thing they'll end up doing is moving the really bad people from the private sector to the government. I get the feeling they slept through a large part of world history. I continue to hear arguments than sound reasonable. I continue to hear wonderfully-intricate arguments. What I've yet to hear is any of these yahoos recognize exactly what kinds of trade-offs they're pitching. I get the feeling I'm watching very poor workmen, focused on the tiny job in front of them instead of the ramifications of that job. I don't think we need to argue that many of these people are wrong as much as we need to argue that many of these people are incompetent. It doesn't bode well for the future.
tempodox 9y ago
"Every situation we can't cheat our way out of is unfair."
phkahler 9y ago
You can't legislate reality. You can't legislate physics, or the value of pi, or weather or not it's technically possible to create nuclear weapons. The fact is that strong public key encryption is possible with a few lines of code. No matter how hard they jump up and don't the universe is not going to put that genie back in the bottle because someone writes a law or an executive order.
- consto 9y ago
  > You can't legislate [...] the value of pi Amusingly someone (inadvertently) tried: https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill
- marcoperaza 9y ago
  I tend to think that encryption should not be regulated, but I don't agree with your analysis either; it's too dismissive of a much more nuanced reality. You can very easily make it so all consumer devices ship with software that only uses encryption that the government has escrowed keys for. You can require app stores to have the same requirement. The government requires all sorts of things of people who manufacture products. Of course, they can't regulate the 3d printer or CNC mill in your garage, but that doesn't make regulating mass-produced products a futile effort. Yes, some people will get around it. They will use open-source software that they download and install themselves on devices that allow sideloading apps. But no one in the government expects perfection out of this. They expect that most criminals, most terrorists even, are not so sophisticated, not so careful, that they will avoid being ensnared. Remember that the situation they are trying to avoid is one where EVERYONE'S texts and phone calls are by-default hopelessly inaccessible to the government, even with a warrant (or in the case of foreign targets, even with the most sophisticated HUMINT and SIGINT).
tim333 9y ago
From a practical point of view I'm not sure there are any criminal activities that have happened because of strong encryption being available? I mean with things like the 911 attacks it didn't seem to make any difference. On the other hand encryption is very useful for financial transactions and the like. It seems the benefits considerably outway the problems.
nokcha 9y ago
I'd argue that any backdoored encryption (which renders the plaintext accessible to the government and to any other entity with access to the backdoor key) is inherently irresponsible. It introduces a single point of failure that will be routinely exposed in the course of ordinary criminal investigations. If US technology companies rely on this encryption to protect their trade secrets, then it's only a matter of time before China finds a way to exfiltrate the backdoor key.
- deleted 9y ago
  [deleted]
alexandercrohde 9y ago
If angels were to govern men, neither external nor internal controls on government would be necessary. In framing a government which is to be administered by men over men, the great difficulty lies in this: you must first enable the government to control the governed; and in the next place oblige it to control itself. -- James Madison
rbcgerard 9y ago
Perhaps the DOJ should take the first step - implement a proof of concept and run all their computers, servers, and communications on it, with a trusted third party holding the keys, say the house judiciary committee.
nathan_long 9y ago
I understand law enforcement's frustration. However, this is quite simple. Encryption relies on keys. Either the government has everyone's keys, or they don't. Any stockpile of encryption keys would give access to millions of people's and businesses' data. It would be a hacking target of inestimable value, targeted by criminal organizations and foreign governments using every technique imaginable. It would be stolen. Period. And every citizen and business would suffer disastrous consequences. We can't say this enough in this debate: making everyone's keys accessible to one entity means they absolutely will be stolen. Whether we trust a government entity's motives isn't even relevant. They do not and cannot have perfect security, and that should end the debate. If anyone doubts that the keys would be stolen, please see: - https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... - https://motherboard.vice.com/en_us/article/qkjkxv/fbi-flash-alert-hacking-group-has-had-access-to-us-govt-files-for-years https://motherboard.vice.com/en_us/article/qkjkxv/fbi-flash-...
- bonestamp2 9y ago
  > It would be a hacking target of inestimable value, targeted by criminal organizations and foreign governments using every technique imaginable. It would be stolen. Period. And we really don't have to look any further than the Equinox hack to prove this. If they think that was bad, and it's clear that nearly all of them do, then imagine it was more than just identity data... what if it was all your actual data. If politicians know that all of their email, their internet history and all of their other secrets will get out if this happens, I wonder if they'll change their minds.
  - op00to 9y ago
    Oh - politicians won't have their data subject to the backdoors, only the rest of us.
bonestamp2 9y ago
Me: Strong encryption that they do have access to is "unreasonable". Thankfully they work for us right?
gumby 9y ago
It's one thing to say "reasonable minds can disagree"; I can empathize with the FBI's position, though I think they are fundamentally wrong. However two things are striking about this speech, and similar recent (over the past few years) ones in the US and UK at least: 1 - Rosenstein is no dummy, so must be perfectly aware of the doublespeak in his statement that they don't want to make things easier for criminals yet companies must provide accomodation for alleged non-criminals. The pre-GWOT NSA took information assurance seriously and, at least in some cases, made encryption stronger for everyone (consider the RSA S-box) even (perhaps) at the expense of the NSA's SIGIINT efforts. I don't know if the Information Assurance Directorate is even staffed any more. 2 - The propaganda is at its most flagrant with the Sutherland shooter: Apple reportedly offered its help but the FBI ignored that until the 48 hours had passed to lock the phone, and then excoriated Apple. Meretricious malpractice, as far as I am concerned. Neither of which makes me in any way supportive of the FBIs position, no matter what actual merit might lie in it.
djweitzner 9y ago
Brings back memories. I'm the Daniel Weitzner mentioned by Eben Moglen. The debate was actually billed as a being about the future of privacy in the digital age. The moderator was Arthur Miller, a truly distinguished law professor at Harvard who wrote about privacy in the 1970s. Despite the broad focus on privacy in the title, the discussion ended up being all about encryption technology and policy. After 45 minutes or so of arguing about encryption, key escrow and the Clipper Chip, Arthur said in his trademark stentorian voice, "This was supposed to be a debate about privacy and all I've heard about is ENCRYPTION!" Despite this, we continued to talk about nothing but cryptography, as if its availability or lack thereof was the only question that mattered for privacy. The Dept of Justice official referred to was Deputy Attorney General Jamie Gorelick, who is now a partner at a big DC law firm WilmerHale, where she represents Jared Kushner and Ivanka Trump. See our paper, Keys under doormats: mandating insecurity by requiring government access to all data and communications, for more. https://doi.org/10.1093/cybsec/tyv009 https://doi.org/10.1093/cybsec/tyv009
cprayingmantis 9y ago
I'm under the impression that encryption should be covered by the second amendment as an 'arm'. Just like guns encryption is there to protect us from malicious parties. If only we could get the NRA or some other more ethical gun club to endorse it as such.

306 points by nimbius 9y ago

deleted 9y ago

[deleted]

hprotagonist 9y ago

encryption that the DOJ has access to, isn't.

rubyfan 9y ago

What did the police do before there was the internet or phones?

olliej 9y ago
Right? Apparently police never solved crime before they were allowed full access to every aspect of your life.
- kobeya 9y ago
  To be fair, it used to be that they didn't really solve most crimes.
  - olliej 9y ago
    there has never been a point where they solved most crimes. The difference is now people just happen to be carrying more information with them in their pocket than they ever had before.
  - mattrices 9y ago
    To be fair, they still don't
thephyber 9y ago
They do just like they do now: lobby to get more laws to either (1) gain more leverage to coerce compliance or (2) criminalize actions which are tangent to the behavior they want to coerce. I realize your question was rhetorical.
AzMoo_ 9y ago
I'm no supporter of insecure cryptography, but before there was internet or phones and access to such, lots of crimes went unsolved.
- wahern 9y ago
  Clearance rates for homicide have _dropped_ over the past 50 years: America’s homicide clearance rate—the percentage of solved crimes that lead to arrest—has fallen considerably in the past 50 years, from around 90% in 1965 to around 64% in 2012, according to federal statistics. (https://www.economist.com/news/united-states/21656725-police-fail-make-arrest-more-third-nations-killings-getting-away https://www.economist.com/news/united-states/21656725-police...) (See, also, https://www.citylab.com/equity/2017/06/police-arent-getting-better-at-solving-murders/531642/ https://www.citylab.com/equity/2017/06/police-arent-getting-...) IMO, similar to counter-terrorism efforts (most spectacularly, 9/11), technology becomes a crutch. Frankly, I wouldn't be surprised if mass encryption leads to _improved_ clearance rates, as law enforcement becomes less complacent. Take this latest example: the FBI agent declines Apple's help because he's convinced the geeks at the FBI lab can handle it. He presumably doesn't bother actually confirming with the geeks in the lab, nor does he attempt to put Apple in touch with the lab. Just utter complacency, confident that the machine (computers, bureaucracy) will suffice. This sort of laziness wouldn't have been tolerated in Hoover's FBI. Moreover, Hoover likely would have been more aggressive using the tools available to him--keyloggers, etc--rather than whining.
  - saulrh 9y ago
    Wouldn't that be a change in data collection more than in absolute quality of problem-solving? Japan, for example, I remember reading that their near-perfect homicide rate is actually because they'll classify it as "fell down some stairs" if they can't solve it. Particularly in the US with its history of social issues, I can easily see a ton of homicides in the 50s just never being written down.
    - bradknowles 9y ago
      Or homicides that were attributed to some person that it was convenient to lock away and who were unable to prove their innocence.
gooseus 9y ago
I imagine they spent a lot of time solving crimes, asking questions like: "Where did they keep all their papers and correspondence?" "Can somebody come break into this safe we have a warrant for?" What did the cops do before X was invented? They didn't worry about X being used to commit or cover up criminal activities while continuing to try to do their job of keeping communities either safe or oppressed, depending on how well they related to them. I support strong crypto, but I think implying detectives and the DoJ are just too lazy or dumb or whatever to deal with this problem is a little unfair. Apologies if that wasn't the implication
- yorwba 9y ago
  Except in most circumstances, there wouldn't have been any papers, because nobody was recording all their conversations. Nowadays, everything is happening digitally and is stored indefinitely by default; and law enforcement feels like they deserve access to all that. The attempts at preventing ubiquitous encryption don't seem to be focused on crimes where there would have been a paper trail if people still used paper; they are focusing on reconstructing the last year or so of someone who is either dead or uncooperative, all in hopes of finding something they can use. If they were targeting organizations with a bureaucracy for some crime, I think they could just demand access to all documents and get them? If I remember correctly, in the Levandowski case Google's lawyers got access to a huge trove of Uber's internal emails. If a private company can get that access, it should be possible for law enforcement as well, no?
- deleted 9y ago
  [deleted]
belorn 9y ago
In my nation, and as I hear in many other places, the police force was much more decentralized in the past. You had local police handling problems at the local level using local knowledge. As I hear/read it was a bit more costly, had the occasional problem of local corruption, quality had a bit more variance, organized crime was a bigger problem, but the average crime had better results and was done quicker. There was also no mass surveillance.
- dx034 9y ago
  That's also because criminals needed local knowledge. If I wanted to commit a crime today in another city, I can get there easily and quickly and get all the info I need online. In the past, small cities would've noticed strangers but (luckily) you can walk through other cities nowadays without people objecting that. For the police that means that they need to follow criminals and be able to share information nationally and internationally.
bonestamp2 9y ago
They would open letters, tap phones and watch bank accounts. All of those things can be subverted now. That said, they were just lucky back then... it doesn't mean everyone should suddenly give up their right to privacy now.

olliej 9y ago

I wish this could be hammered into the thick heads of congress: there is secure, and there is insecure. There is not a gradient.

SomeStupidPoint 9y ago
That's... just not true. And that kind of misrepresentation just weakens the arguments for strong encryption, because intelligent people will see them as pretty transparent misrepresentations. Have you considered that's why the arguments for strong encryption aren't going well -- that we're not actually engaging with intelligent people trying to understand the issue, we're chanting trite, shallow inaccuracies? I mean -- "there is not a gradient"? ...what do you call changing key size? Ed: I'd like the people downvoting to explain how changing the keysize isn't a gradient of security. (Hint: You can't, because it is.)
- olliej 9y ago
  We change key size because what is secure in terms of key size is literally compute bound. Key strength changes because we predict when a key will /cease being secure/. That said most of the demands made by DoJ aren't for reduced key size, they're for variations of key /escrow/: literally breaking the security model of crypto entirely. So maybe I could be more specific: there is no such thing as an almost secure protocol. The key (ha!) result of this recognition is that all secure protocols have been moving to some variant of ephemeral keys. Specifically to deal with the problem of all static keys eventually becoming insecure.
  - SomeStupidPoint 9y ago
    > Key strength changes because we predict when a key will /cease being secure/. Yes, we use keys up the gradient of security that key size represents as attacks become more powerful. The reason we don't use the more secure keys in the first place isn't that 2048b keys weren't always more secure than 1024b keys -- it's just that we didn't (for most purposes) need to be that secure, and so we choose an appropriate spot on the gradient for our cost-benefit analysis. Pretending that's not a gradient of security is simply dishonest. > That said most of the demands made by DoJ aren't for reduced key size, they're for variations of key /escrow/: literally breaking the security model of crypto entirely. That's missing the plot for the details: the DoJ wants a method by which they can break into digital safes in a manner similar to physical safes. Their proposal is key escrow, but that's partly because technologists didn't suggest a better way when the DoJ simply asked to get it done with little guidance. So they made a specific ask. And it sucks -- because they're not technologists. Everyone knows it, but the DoJ isn't inclined to let people flat out refuse. Pretending that there aren't technical solutions with transparent ruses -- like there aren't gradients of security -- are how we got to lawyers demanding technical features. I don't disagree with you that we should use secure protocols, I'm just saying we need to hold ourselves accountable for honest and strong arguments, not ruses. The one you end on -- that using ephemeral keys is fundamentally a stronger algorithm that doesn't work well with long term taps -- is a strong argument. Much better than things like "there aren't security gradients" -- partly because they're actually true.

tzs 9y ago

If they want to convince me to accept some kind of back door in my encryption, they have to propose a system where it can be shown that it cannot be abused by bad actors within my government, and where there are clearly stated public rules about when it can be used. It is possible to design such a system, where the probability of abuse is arbitrarily low [1], but I have a hard time imagining the current DOJ proposing such a thing. [1] key escrow with access controlled by a multilevel secret sharing system that requires consensus among a diverse international group of shareholders to release the key from escrow. The shareholder group is chosen so that it includes a mix of public and private entities in a variety of jurisdictions, including anonymous shareholders, so that no entity can acquire enough power or influence to force a key to be revealed.

kobeya 9y ago
> key escrow with access controlled by a multilevel secret sharing system that requires consensus among a diverse international group of shareholders to release the key from escrow. The shareholder group is chosen so that it includes a mix of public and private entities in a variety of jurisdictions, including anonymous shareholders, so that no entity can acquire enough power or influence to force a key to be revealed. Intelligence agencies will just steal the keys, and then individual actors leak them onto the black market.
- tzs 9y ago
  The probability of that can be made arbitrarily low by proper choice of parameters for the secret sharing system, at least against realistic threats over realistic timeframes.
  - heylook 9y ago
    What are some examples of such parameters?
    - justinjlynn 9y ago
      That's a good question. We should probably be cooperating to find out instead of asking it to silence ideological opponents. It might be useful to know for transient key secure multiparty computation.

CyberDildonics 9y ago

I think people not having access to the details of their government is unreasonable.

c3534l 9y ago

The government has demonstrated that they will abuse every power given to them, and even those that weren't. I would not entrust every aspect of my personal information to the very same organizations that indefinitely detains people, including American citizens, without access to a lawyer while commiting acts of torture; and the ones that said the Patriot Act could never be used for domestic surveilance; that lied about being unable to unlock the phone of the last guy they tried this with to get the law changed; and that continues to engage in parallel construction, torture by proxy, and extraordinary rendition. And now they're saying that we should trust them to stop those bad guys once again. And the most chilling aspect of this request, despite its inherent absurdity, unenforcibility, and threat to freedom and privacy, is that they have a very good chance of winning that power.

alsetmusic 9y ago
> that lied about being unable to unlock the phone of the last guy they tried this with to get the law changed… I found it very telling that they announced their inability to access the phone only a few days after the incident. It struck me as a very clear PR move that was designed to lay the groundwork to shape public opinion. My threshold for declaring that the device is inaccessible requires more time for research and effort than this.
- c3534l 9y ago
  Don't forget that the phone was unencrypted when they got it, and that it was the FBI who locked it in the first place: https://www.nytimes.com/2016/03/02/technology/apple-and-fbi-face-off-before-house-judiciary-committee.html https://www.nytimes.com/2016/03/02/technology/apple-and-fbi-...
  - alsetmusic 9y ago
    I have no idea how I never knew that. I thought I followed the case fairly well, but had never read about user error on the part of the FBI. For all the articles written, this was a very under reported detail.
9y ago

deleted 9y ago

[deleted]

PenguinCoder 9y ago

The wording of this brings up a worrisome point. What encryption methods does the DOJ currently have access to? Why are they complaining about needing access to this encryption now? Is it because other previous encryption methods are know to be broken or they already have access to that data?

MichaelGG 9y ago
Probably because so many communications are moving to encrypted by default, HTTPS everywhere and WhatsApp for instance (as Brazil has found out). If the big players decide to switch to E2E then governments would need to get them to change their products. Better to head them off before it is too late.
- 0xfeba 9y ago
  This is exactly it. The Going Dark Problem: https://www.fbi.gov/services/operational-technology/going-dark https://www.fbi.gov/services/operational-technology/going-da...

api 9y ago

This has been the refrain for 35 years. Open source strong encryption is everywhere now. The horse has left the barn, farm, county, state, and is currently swimming the Pacific. Police have other ways to fight crime. Eventually we may be forced to deploy the ultimate weapon, namely correcting the social, economic, psychological, and neurological factors that breed it in the first place.

bo1024 9y ago

It's hard to know where to even begin in arguing against this. There's the freedom/privacy argument, but I guess this is debatable depending on if you view computer files as an extension of your ideas/knowledge, or an extension of your physical possessions. Someone brought up the entire "risk of overreach and abuse" argument. There's also the likelihood of any tools the government has being leaked and used by bad actors (as we have seen too much recently). Oh, and the "it's technologically impossible" argument, which should be the only one you need -- but they refuse to hear that. (Are there some supposed experts who are telling the DOJ this can be done?)

1001101 9y ago
> Someone brought up the entire "risk of overreach and abuse" argument. I don't have a problem with the authorities operating within the purview of the Constitution, eg. a warrant from a court for a particular device. That, however, is not how we got to where we are today.
hackinthebochs 9y ago
>Oh, and the "it's technologically impossible" argumentbe the only one you need -- but they refuse to hear that. Things like DUAL_EC_DRBG seem to prove this claim false.
- bo1024 9y ago
  I guess if you set the bar for what you want to accomplish at barely above "nobody is allowed to encrypt anything, ever." Nobody would knowingly use such a scheme. It's also a security hole giving access to anyone with the key, which is sure to be leaked/compromised if shared with the entire DOJ and others. Also, once the key is compromised, everything in the past that was ever encrypted is now readable by anyone.
  - hackinthebochs 9y ago
    >Nobody would knowingly use such a scheme. Actually, most people would use it because most people just don't care that much. >which is sure to be leaked/compromised if shared with the entire DOJ and others But this is a policy issue, not an issue with the idea of backdoored encryption. There are policies that could reduce the probability of leak to negligible levels (e.g. a secure NSA facility does all the decryption). Not to mention that only the NSA will be in a position to decrypt your communications from 5 years ago. No one else is storing such a vast quantity of data.

gxs 9y ago

When I was in college, there was a retired guy that would come in to tutor students as a way to stay busy. He was your stereotypical brainiac type dude - quiet, lanky, glasses, soft spoken, and razor sharp. He must have been in his 50s, but you would think he had just completed upper division math, chemistry, and physics "last semester" with perfect grades to boot. He told me a story about how once while in his Masters program, one of his colleagues figured out how to do some cool stuff with unenriched uranium. Almost like out of a movie, he said, the government stepped in and made sure he did not publish his research. I wonder if we'll see that type of stuff happen with cryptography or if it's already happening. I wouldn't be surprised if these theatrics were just to maintain the illusion that they don't have access to stuff.

AstralStorm 9y ago
And then Chinese figure it out for a third of the price and have a monopoly on nuclear reactors. Remember the time when organisations like DARPA actually promoted public research of this magnitude? Or when DoD was making certain research public?

brian-armstrong 9y ago

Here's my biggest complaint with this debate - people are confusing literal with metaphorical. They make the analogy of the unbreakable safe. Encryption isn't that. You can still recover the physical phone and all of the storage chips on it. That the patterns of bits in the chips make up some unrecognizable utterance is seemingly immaterial. I could write gibberish in my journal at home if I wanted to, and I think we'd all agree it would be ridiculous for the FBI to run around screaming about unbreakable ink

tryingagainbro 9y ago
His comment makes sense to 99% on non-tech people, and if it was possible it would make sense to all. Would we want to open Bin Laden's iPhone? He wants you to have your home with 100 locks, guard dogs and armed guards. BUT if a court orders you, you have to let the police in to check x, y and z. Now I don't think that a secret key can be somewhere and stay safe for a long time. It will be leaked or hacked. This places hundreds of million innocent people at extreme danger of having everything personal revealed. So, IMO, giving the cops a master key opening all our doors "if needed" doesn't work. TSA does that, but presumably while cameras are running, and this is stuff we know it will be searched. So encryption is the best option.
- brian-armstrong 9y ago
  But again you've made the same error. The locks can be opened and the phone retrieved. iPhones are not indestructible, you can access any part of them if you want.
  - tryingagainbro 9y ago
    And do what with an encrypted one? They want the contents, not the phone. Frankly, they might even return it after making a copy of it /fingerprints etc.. Spend $1m on a zero day for each case? What if they run out of zero-days?
    - JoshTriplett 9y ago

oceanghost 9y ago

These complaints have always felt like disinformation to me. I assume they have larger capabilities than they let on, its just they can't prosecute without revealing that.

rayiner 9y ago

I can’t overstate how important it is for Google, Apple, and Microsoft to keep hammering at this. It’s workkng. The DOJ is running into this a lot now (e.g. can’t get into a drug dealer’s iPhone to see who he’s messaging). Eventually, they’ll see that the ship has sailed and encryption is just something they have to deal with.

cvwright 9y ago
That's an incredibly optimistic take on this problem. Google, Microsoft, EFF, et al need to win every single battle or they lose the whole war. The DOJ just needs to find one sympathetic test case, or one sufficiently horrible incident to get the laws changed. Like the Patriot Act in the US, or the new French surveillance law that passed after the Bataclan attacks. It's the classic asymmetry problem that makes security so hard in general. Only now, the party with all the money and power and time is also the one who only needs to win once.

arca_vorago 9y ago

This subject always reminds me of a talk I heard Eben Moglen give, where he said: "In 1995, there was a debate at Harvard Law School – four of us discussing the future of public key encryption and its control. I was on the side, I suppose, of freedom. It’s where I try to be. With me at that debate was a man called Daniel Weitzner who now works in the White House making Internet policy for the Obama administration. On the other side was the then Deputy Attorney General of the United States and a lawyer in private practice named Stewart Baker who had been chief council to the National Security Agency, our listeners, and who was then in private life helping businesses to deal with the listeners. He then became, later on, the deputy for policy planning in the Department of Homeland Security in the United States and has much to do with what happened in our network after 2001. At any rate, the four of us spent two pleasant hours debating the right to encrypt and at the end there was a little dinner party at the Harvard faculty club, and at the end, after all the food had been taken away and just the port and the walnuts were left on the table, Stuart said, “All right, among us now that we are all in private, just us girls, I’ll let our hair down.” He didn’t have much hair even then, but he let it down. “We are not going to prosecute your client, Mr. Zimmermann," he said. “Public key encryption will become available. We fought a long, losing battle against it, but it was just a delaying tactic.” And then he looked around the room and he said, ”But nobody cares about anonymity, do they?" And a cold chill went up my spine and I thought, all right, Stuart, and now I know you’re going to spend the next twenty years trying to eliminate anonymity in human society and I am going to try to stop you and we’ll see how it goes. And it’s going badly." https://www.softwarefreedom.org/events/2012/Moglen-rePublica-Berlin/transcript.html https://www.softwarefreedom.org/events/2012/Moglen-rePublica...

phkahler 9y ago
It's odd because peoples desire for anonymity is preventing their use of good encryption. A solid online identity and reliable way to get data to you without 3rd parties would be a good foundation for exchanging keys and encrypting data between parties. I'm talking fixed IP addresses as a starting point. We have whole infrastructure to make it easy to interact with public web sites (DNS, etc) but it's very hard to find and send a packet to your friend. Any efforts to change this would be seen by a lot of people as an attack on anonymity. I don't want make believe anonymity, I want to know where data is going and where it's coming from. Once I have that I can encrypt for privacy and web sites can strip identifying information if they want to provide an anonymous forum.

rrhd 9y ago

> "And I think that's a legitimate issue that we can debate—how much risk are we willing to take in return for the reward?" he said. None. Stop talking you ignorant fool.

hguhghuff 9y ago

Is this crazy or not? And if it's crazy, what's the best way to argue against it?

unabst 9y ago

The argument here is extremely simple. Encryption is the only way to secure information. This is true for criminals and non-criminals alike. To deny encryption is to deny security to everyone. Presuming it's the criminals who will look to exploit these vulnerabilities, denying security is making every non-criminal susceptible to attack. So the only question that needs to be answered is this. Do we want to protect our citizens? The only answer is yes. The only solution is encryption. The problem with strong encryption is that it already exists. Even if strong encryption were made illegal, criminals will be the one's securing their data despite the law. To deny citizens the right to protect themselves is just putting them all at risk. It's disarmament. Under the law, all the police should need is a warrant. It's not even an exception to any rule.

bradknowles 9y ago
But how do you design a strong encryption algorithm that can be trivially unlocked once a warrant is provided? Answer: you can’t.
- unabst 9y ago
  That's not the point. Like a body buried in the desert, there is nothing that can force a person to reveal anything. Silence is encryption enough when it comes to secrets. Torture doesn't work either. So it's business as usual. It's obstruction of justice. Book'em. And of course, "I can't remember" is always the greatest defense. This whole thing is about the government endangering the public in exchange for abusing their rights. It's all bad. You could go as far as argue that the government is obstructing justice and endangering the public by denying basic security. We already know the enemy will find ways to access all the data. Encryption is not the last line of defense. It's the only line.
  - AstralStorm 9y ago
    Can't remember is a statement that can be disproven. Pleading non self incrimination laws (as per Miranda) is more effective. Even if you have nothing incriminating. This is what DoJ wants to close by making just possession of encrypted documents criminal. (Note: not a lawyer.)

nickwanninger 9y ago

Gotta love the fact that the EU seems to think the exact opposite https://www.theguardian.com/technology/2017/jun/19/eu-outlaw-backdoors-new-data-privacy-proposals-uk-government-encrypted-communications-whatsapp https://www.theguardian.com/technology/2017/jun/19/eu-outlaw...

Freak_NL 9y ago
It's not as simple as that. In the EU there are lots of political factors (like the director of the Dutch intelligence service, to name just one) that are quite vocal about abolishing strong end-to-end encryption; just as there are political factors in the US that wish to grant citizens the freedom to use strong encryption unencumbered.
- dx034 9y ago
  But apart from the UK, Intelligence services in European countries tend to have less influence and aren't as popular with the general public. Many people have bad experience with intelligence services (Germany in the 30s/40s, Eastern European countries until 1990) so that there's still a lot of mistrust. That has changed a bit with recent terror attacks (fear of terror outweighs other fears) but in general, data protection is taken much more seriously in Europe than in other regions and that doesn't only include companies but also the state.
- sametmax 9y ago
  Which is funny when you think they invented enigma in the first place.
  - Freak_NL 9y ago
    The Enigma machine was invented by the Germans, not the Dutch.
    - sametmax 9y ago
      Sorry, deutschemark being the german money before the euro, I still confuse them in my head.

hinkley 9y ago

The reasonable man adapts himself to the world: the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man. - George Bernard Shaw

jarym 9y ago

Governments are the next on the Silicon Valley ‘disrupt’ list. The music industry had to be dragged kicking and screaming away from their physical distribution model. Governments will have to be dragged similarly until they accept encrypted content is something they have the same right of access to as private thoughts.

Dowwie 9y ago

The moment that the US government stops complaining about encryption is when you will know that it has found a way through it.

dx034 9y ago
That would be too transparent. Also, if they really crack popular encryption, only few people will know to avoid any leaks. Maybe they'd complain even more to give people the feeling that they cannot crack that particular method.

DanielBMarkham 9y ago

"law enforcement equities" What an odd phrase. We have a criminal justice system in this country that is adversarial and is tilted in favor of the accused. That's because our founders realized the immense power of the state could easily overrun any person it wanted to unless there were strict and tight guards on what they could do. These lawyers, who presumably should know much more about all of this than I do, continue to make cases that strike me as "There are bad people! Because they are really bad, we need to change the game to give us more power" But there have always been bad people. There always will be. There is no stopping that fact. It is part of being human. I wonder if these people realize that even if they continue to get their way, the only thing they'll end up doing is moving the really bad people from the private sector to the government. I get the feeling they slept through a large part of world history. I continue to hear arguments than sound reasonable. I continue to hear wonderfully-intricate arguments. What I've yet to hear is any of these yahoos recognize exactly what kinds of trade-offs they're pitching. I get the feeling I'm watching very poor workmen, focused on the tiny job in front of them instead of the ramifications of that job. I don't think we need to argue that many of these people are wrong as much as we need to argue that many of these people are incompetent. It doesn't bode well for the future.

tempodox 9y ago

"Every situation we can't cheat our way out of is unfair."

phkahler 9y ago

You can't legislate reality. You can't legislate physics, or the value of pi, or weather or not it's technically possible to create nuclear weapons. The fact is that strong public key encryption is possible with a few lines of code. No matter how hard they jump up and don't the universe is not going to put that genie back in the bottle because someone writes a law or an executive order.

consto 9y ago
> You can't legislate [...] the value of pi Amusingly someone (inadvertently) tried: https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill
marcoperaza 9y ago
I tend to think that encryption should not be regulated, but I don't agree with your analysis either; it's too dismissive of a much more nuanced reality. You can very easily make it so all consumer devices ship with software that only uses encryption that the government has escrowed keys for. You can require app stores to have the same requirement. The government requires all sorts of things of people who manufacture products. Of course, they can't regulate the 3d printer or CNC mill in your garage, but that doesn't make regulating mass-produced products a futile effort. Yes, some people will get around it. They will use open-source software that they download and install themselves on devices that allow sideloading apps. But no one in the government expects perfection out of this. They expect that most criminals, most terrorists even, are not so sophisticated, not so careful, that they will avoid being ensnared. Remember that the situation they are trying to avoid is one where EVERYONE'S texts and phone calls are by-default hopelessly inaccessible to the government, even with a warrant (or in the case of foreign targets, even with the most sophisticated HUMINT and SIGINT).

tim333 9y ago

From a practical point of view I'm not sure there are any criminal activities that have happened because of strong encryption being available? I mean with things like the 911 attacks it didn't seem to make any difference. On the other hand encryption is very useful for financial transactions and the like. It seems the benefits considerably outway the problems.

nokcha 9y ago

I'd argue that any backdoored encryption (which renders the plaintext accessible to the government and to any other entity with access to the backdoor key) is inherently irresponsible. It introduces a single point of failure that will be routinely exposed in the course of ordinary criminal investigations. If US technology companies rely on this encryption to protect their trade secrets, then it's only a matter of time before China finds a way to exfiltrate the backdoor key.

deleted 9y ago
[deleted]

alexandercrohde 9y ago

If angels were to govern men, neither external nor internal controls on government would be necessary. In framing a government which is to be administered by men over men, the great difficulty lies in this: you must first enable the government to control the governed; and in the next place oblige it to control itself. -- James Madison

rbcgerard 9y ago

Perhaps the DOJ should take the first step - implement a proof of concept and run all their computers, servers, and communications on it, with a trusted third party holding the keys, say the house judiciary committee.

nathan_long 9y ago

I understand law enforcement's frustration. However, this is quite simple. Encryption relies on keys. Either the government has everyone's keys, or they don't. Any stockpile of encryption keys would give access to millions of people's and businesses' data. It would be a hacking target of inestimable value, targeted by criminal organizations and foreign governments using every technique imaginable. It would be stolen. Period. And every citizen and business would suffer disastrous consequences. We can't say this enough in this debate: making everyone's keys accessible to one entity means they absolutely will be stolen. Whether we trust a government entity's motives isn't even relevant. They do not and cannot have perfect security, and that should end the debate. If anyone doubts that the keys would be stolen, please see: - https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... - https://motherboard.vice.com/en_us/article/qkjkxv/fbi-flash-alert-hacking-group-has-had-access-to-us-govt-files-for-years https://motherboard.vice.com/en_us/article/qkjkxv/fbi-flash-...

bonestamp2 9y ago
> It would be a hacking target of inestimable value, targeted by criminal organizations and foreign governments using every technique imaginable. It would be stolen. Period. And we really don't have to look any further than the Equinox hack to prove this. If they think that was bad, and it's clear that nearly all of them do, then imagine it was more than just identity data... what if it was all your actual data. If politicians know that all of their email, their internet history and all of their other secrets will get out if this happens, I wonder if they'll change their minds.
- op00to 9y ago
  Oh - politicians won't have their data subject to the backdoors, only the rest of us.

bonestamp2 9y ago

Me: Strong encryption that they do have access to is "unreasonable". Thankfully they work for us right?

gumby 9y ago

It's one thing to say "reasonable minds can disagree"; I can empathize with the FBI's position, though I think they are fundamentally wrong. However two things are striking about this speech, and similar recent (over the past few years) ones in the US and UK at least: 1 - Rosenstein is no dummy, so must be perfectly aware of the doublespeak in his statement that they don't want to make things easier for criminals yet companies must provide accomodation for alleged non-criminals. The pre-GWOT NSA took information assurance seriously and, at least in some cases, made encryption stronger for everyone (consider the RSA S-box) even (perhaps) at the expense of the NSA's SIGIINT efforts. I don't know if the Information Assurance Directorate is even staffed any more. 2 - The propaganda is at its most flagrant with the Sutherland shooter: Apple reportedly offered its help but the FBI ignored that until the 48 hours had passed to lock the phone, and then excoriated Apple. Meretricious malpractice, as far as I am concerned. Neither of which makes me in any way supportive of the FBIs position, no matter what actual merit might lie in it.

djweitzner 9y ago

Brings back memories. I'm the Daniel Weitzner mentioned by Eben Moglen. The debate was actually billed as a being about the future of privacy in the digital age. The moderator was Arthur Miller, a truly distinguished law professor at Harvard who wrote about privacy in the 1970s. Despite the broad focus on privacy in the title, the discussion ended up being all about encryption technology and policy. After 45 minutes or so of arguing about encryption, key escrow and the Clipper Chip, Arthur said in his trademark stentorian voice, "This was supposed to be a debate about privacy and all I've heard about is ENCRYPTION!" Despite this, we continued to talk about nothing but cryptography, as if its availability or lack thereof was the only question that mattered for privacy. The Dept of Justice official referred to was Deputy Attorney General Jamie Gorelick, who is now a partner at a big DC law firm WilmerHale, where she represents Jared Kushner and Ivanka Trump. See our paper, Keys under doormats: mandating insecurity by requiring government access to all data and communications, for more. https://doi.org/10.1093/cybsec/tyv009 https://doi.org/10.1093/cybsec/tyv009

cprayingmantis 9y ago

I'm under the impression that encryption should be covered by the second amendment as an 'arm'. Just like guns encryption is there to protect us from malicious parties. If only we could get the NRA or some other more ethical gun club to endorse it as such.